linux-kernel - Re: [PATCH net-next RFC] netfilter: flowtable: add CT metadata action for nft flowtables

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CA+SN3sqzRMWVF5ZTW+hjsKjGfvsGzCn2qUt+uvNWAzeYD-54hw@mail.gmail.com>
Date: Sun, 14 Sep 2025 09:40:22 +0300
From: Elad Yifee <eladwf@...il.com>
To: Florian Westphal <fw@...len.de>
Cc: Pablo Neira Ayuso <pablo@...filter.org>, Jozsef Kadlecsik <kadlec@...filter.org>, Phil Sutter <phil@....cc>, 
	"David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, 
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, Simon Horman <horms@...nel.org>, 
	netfilter-devel@...r.kernel.org, coreteam@...filter.org, 
	netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH net-next RFC] netfilter: flowtable: add CT metadata action
 for nft flowtables

On Sat, Sep 13, 2025 at 11:52 PM Florian Westphal <fw@...len.de> wrote:
>
> Under what circumstances can flow->ct be NULL?
I thought it could be NULL in a few cases. I’ll verify this on the
inet/IPv4/IPv6 path and report back in the next spin.
In any case, the null-guard is harmless, so I kept it.

> This looks almost identical tcf_ct_flow_table_add_action_meta().
>
> Any chance to make it a common helper function? act_ct already depends
> on nf_flow_table anyway.
agreed. If there are no objections to the main idea (exporting CT
metadata on the nft flowtable path),
I’ll prepare a new series that factors the fill logic into a shared
helper and converts both act_ct and the nft exporter to use it

Thanks for your feedback